---
id: CVE-2026-91867
title: >-
  When Neethi fetches a remote policy reference, it only limits the time per
  read, not the whole transfer, so a server that trickles bytes slowly can keep
  the fetch alive indefinitely and tie up the calling thread (denial of
  service).

  User…
summary: >-
  When Neethi fetches a remote policy reference, it only limits the time per
  read, not the whole transfer, so a server that trickles bytes slowly can keep
  the fetch alive indefinitely and tie up the calling thread (denial of
  service).

  User…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L'
cwe:
  - CWE-400
vendor: apache
product: neethi
affected:
  - neethi < 3.2.4
patched:
  - neethi 3.2.4
published: '2026-09-21'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T13:09:43.217'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-91867'
references:
  - url: 'https://lists.apache.org/thread/dsr2ktf199mqhw2jtlbklyz7tzd86ycd'
    label: security@apache.org
  - url: 'http://www.openwall.com/lists/oss-security/2026/09/18/14'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - cve.org
epss: 0.00497
epssPercentile: 0.424
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-21T13:14:25.401436Z'
ingestedAt: '2026-09-21T11:35:54.434Z'
---

## Overview

When Neethi fetches a remote policy reference, it only limits the time per read, not the whole transfer, so a server that trickles bytes slowly can keep the fetch alive indefinitely and tie up the calling thread (denial of service).
Users are recommended to upgrade to version 3.2.4, which fixes this issue.

## Affected

- `neethi < 3.2.4`

## Remediation

Upgrade past the affected range:

- `neethi 3.2.4`